Well, I wouldn't call a firewall magic, but that's what it does. If a package is setup so the software listens to 0.0.0.0 (all networks) on a particular port then the firewall will prevent incoming attacks. Opening the firewall port is an extra step that requires two misconfigurations rather than one. Look up fail-safe for more reading.